When setting up a user for SMTP auth for sending alerts, the password is always clear-text in the GUI (I don't know about at the file). (as of 9f50559 - Mon Oct 31 2016 18:25:08 GMT-0600 )
This password MUST be obfuscated, preferably as typed. Stars, whatever, this is pretty common here.
fix: use password type for SMTP Auth #5051